I have a bit of a quandry that I'm not sure what the best solution is.

In V2 you can have all kinds of custom groups with custom rights (which
is great). One of the main problems with V1 was the amount of security
the administrator had to do. With V2 we were looking to offload site
security to individual site managers.

The dilemma is that we don't want to give site managers complete access
(i.e. we don't want them to create document or meeting workspaces or
sub-sites). In order to give them the right to add their own users to a
site group we have to give them the "Manage Site Group" right. This now
means that if they're unhappy that they can't create a document
workspace, they can just go into the site group manager and give
themselves that permission.

Any ideas on this or should we just accept the fact that they'll be able
to do anything once they get the manage site group right and leave it at
that?